複数のアクセス拒否設定をしたS3バケットをCloudFormationで作ってみた

AWSTemplateFormatVersion: 2010-09-09
Description: Access Restricted S3 Bucket

Parameters:
  S3BucketName:
    Description: Type of this BacketName.
    Type: String

Resources:
  SampleBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub ${S3BucketName}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  SampleBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref SampleBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
            - 's3:*'
            Effect: Deny
            Sid: MultiRestrictPolicy
            Resource: 
              - !Sub 'arn:aws:s3:::${SampleBucket}'
              - !Sub 'arn:aws:s3:::${SampleBucket}/*'
            Principal: '*'
            Condition:
              StringNotLike:
                'aws:userId':
                  - "AROAxxxxxxxxxxxxxxxxx:*"
              NotIpAddress:
                'aws:SourceIp':
                  - 111.222.333.444/32
              StringNotEquals:
                'aws:SourceVpce':
                  - "vpce-1a2b3c4d"
                "aws:CalledVia":
                  - "cloudformation.amazonaws.com"          

Outputs:
  SampleBucket:
    Value: !Ref SampleBucket